Extracted

• • Target

    JaffaCakes118_a516e86c8ec65bb968381714a3c4e519

  • Size

    244KB

  • MD5

    a516e86c8ec65bb968381714a3c4e519

  • SHA1

    8f087bcf45f44598acec90f0ec5e7d58442f1825

  • SHA256

    12ae91e8f18b3853619f0c606f55e0abb100ed01b1b39ce2c635d99fa0974933

  • SHA512

    fb12cf7ab017c8f7575cce44e963fc6ed1bad5b8eebe3b3a7463f46458e582922ba6f04251e84038c95282e083d2323531077021fe50567623fc58cc5cb14f87

  • SSDEEP

    3072:57fMkIgBaWzhUgPYFdNBf+RA7L2G7R6U6nmJmnqYV1XPkUTkJauN8NeM4RZS:9QsvYmRAf2G7Rt6mkV1XPkekJtVZ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1